Antivirus Definition Mistakenly Removes Winlogon.exe

Thomas Bowcut — Fri, 30 Oct 2009 18:58:23 +0000

Half our companies IT infrastructure was brought down by a bad virus definition which was downloaded and pushed out to all clients and servers on October 28th, 2009. The virus definition, def. 5474 distributed by Sunbelt Software’s VIPRE Enterprise Antivirus software, mistakenly interpreted the winlogon.exe file to be a virus and immediately put it in quarantine. The winlogon.exe file is a critical windows file required at system logon, if Windows XP cannot find this file when starting up then the system will crash displaying the famous Blue Screen with the an error similar to the following:

STOP: C000021a {Irreversible System Error} Windows logon process terminated unexpectedly with state (0×00000000 0×00000000). The system has been closed.

Unfortunately the timing of the virus definition release corresponded with the schedule of our weekly deep scan on all client PCs. As a result close to half the company found their PCs inaccessible the next morning upon starting-up their computers. We still have to determine why not all of the systems were affected; from our experience it appears to have only affected Windows XP and Windows Server 2003 operating systems.

Fortunately after getting in contact with VIPRE support we were able to confirm that the source of the issue was related to a False Positive error in the definition file 5474 and that file definition 5475 was already available with the correction. Unfortunately, VIPRE does not yet have an easy fix to the problem, however in a follow-up email to our support ticket they indicated that “have been working on developing a bootable ISO utility designed to unquarantine the files detected by the FP (false positive)”.

Until the bootable ISO is made available to release the quarantined file the following steps are necessary to make the system once again accessible:

1. Copy the winlogon.exe file from C:\windows\system32\ on a working Windows XP machine to either a floppy disk or burn to a CD-ROM

2. Boot the system from a Windows XP installation disk. Press “R” on the first screen that asks whether to install windows or to recover an existing Windows XP installation. This will open the Recovery Console

3. Select the Operating System that you will be recovering by pressing the corresponding number from the displayed list. Type the password for the local Administrator account.

4. Insert the CD-ROM or Floppy Disk and copy the winlogon.exe file to the C:\windows\system32\ directory. (ex: \\>copy d:\winlogon.exe c:\windows\system32\)

5. Reboot the pressing F8 on start-up to launch Windows in Safe Mode with Command Prompt

6. After Windows starts up login with the local Administrator account

7. Delete the virus definition files. To do so for VIPRE go to the definitions folder (C:\Program Files\Sunbelt Software\SBEAgent\Definitions\) and delete all the contents.

8. Reboot the system

Following this procedure we have been able to get all systems back up and running.

If you have experienced similar issues please leave a comment regarding your experience.

SQL Data Types

Thomas Bowcut — Mon, 13 Nov 2006 14:27:35 +0000

I have found that on multiple occasions I have wanted to refer to the list of available data types in MS SQL or MySQL. I am currently working on a project in MS SQL and found the following definition of SQL data types. I am posting this to my list of handy references.

Data Types	Description
bigint	Integer data from -2^63 through 2^63-1
int	Integer data from -2^31 through 2^31 – 1
smallint	Integer data from -2^15 through 2^15 – 1
tinyint	Integer data from 0 through 255
bit	Integer data with either a 1 or 0 value
decimal	Fixed precision and scale numeric data from -10^38 +1 through 10^38 -1
numeric	Fixed precision and scale numeric data from -10^38 +1 through 10^38 -1
money	Monetary data values from -2^63 through 2^63 – 1
smallmoney	Monetary data values from -214,748.3648 through +214,748.3647
float	Floating precision number data from -1.79E + 308 through 1.79E + 308
real	Floating precision number data from -3.40E + 38 through 3.40E + 38
datetime	Date and time data from January 1, 1753, through December 31, 9999, with an accuracy of 3.33 milliseconds
smalldatetime	Date and time data from January 1, 1900, through June 6, 2079, with an accuracy of one minute
char	Fixed-length character data with a maximum length of 8,000 characters
varchar	Variable-length data with a maximum of 8,000 characters
text	Variable-length data with a maximum length of 2^31 – 1 characters
nchar	Fixed-length Unicode data with a maximum length of 4,000 characters
nvarchar	Variable-length Unicode data with a maximum length of 4,000 characters
ntext	Variable-length Unicode data with a maximum length of 2^30 – 1 characters
binary	Fixed-length binary data with a maximum length of 8,000 bytes
varbinary	Variable-length binary data with a maximum length of 8,000 bytes
image	Variable-length binary data with a maximum length of 2^31 – 1 bytes
cursor	A reference to a cursor
sql_variant	A data type that stores values of various data types, except text, ntext, timestamp, and sql_variant
table	A special data type used to store a result set for later processing
timestamp	A database-wide unique number that gets updated every time a row gets updated
uniqueidentifier	A globally unique identifier

For additional information on choosing MS SQL Server data types, the source of the above table, refer to the following article:

Choosing SQL Server 2000 Data Types
By Alexander Chigrik

Thinkworx » Handy References

Antivirus Definition Mistakenly Removes Winlogon.exe

SQL Data Types